bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8

max time kernel
167s
max time network
297s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
Size

1.9MB
MD5

bab406ad3b0603a45625755ffbccce49
SHA1

7ce0bd31c68c5b54854098acad195b7a8d804939
SHA256

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8
SHA512

a85ca2bc5ab42f8d32856a87c665b66df7d8e1c1ebbb143015d06fcc1bddba1faf684e2ee1d2a572f5ed04edf3a061837c293b5c1e3d2214864b90d8a68d25cc
SSDEEP

49152:hgWDef4IXn7EvfNf+x83OeG5ztpAEq2pe2n9SCtQV:hvo49fk83ONztiEqz2nA

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2012-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-10-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-11-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-18-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-43-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-44-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-45-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-54-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-55-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-56-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-105-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-107-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-104-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-102-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-79-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/2012-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

314 discord.com
344 discord.com

flow	ioc
314	discord.com
344	discord.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

description	pid	process	target process
PID 2928 set thread context of 2012	2928	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

pid	process
2012	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
2012	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
2012	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

description	pid	process	target process
PID 2928 wrote to memory of 2012	2928	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2928 wrote to memory of 2012	2928	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2928 wrote to memory of 2012	2928	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2928 wrote to memory of 2012	2928	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2928 wrote to memory of 2012	2928	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2928 wrote to memory of 2012	2928	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2928 wrote to memory of 2012	2928	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2928 wrote to memory of 2012	2928	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2928 wrote to memory of 2012	2928	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

C:\Users\Admin\AppData\Local\Temp\bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
"C:\Users\Admin\AppData\Local\Temp\bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
  "C:\Users\Admin\AppData\Local\Temp\bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
3af58b6add70a3559c53205e4aefd0f9

SHA1
5c1a95db8a1695b14b26cb5e8ae92fea5bd9da41

SHA256
d9595b5e4bb49267b93c50334024de412c0e8a2831f2caa1102529292b9c2a7e

SHA512
21b93f9444d559aa19fd36afd939120623187fd42cf43296447cfa8794d7a72773900405b37587def2e794b7e829d337aaf5b397a8882552875a89023f104f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
9.8MB

MD5
67311cd315bbbaa424239009c70455ca

SHA1
4f22c95d336cedc1aa93b9dd8db71d1185334b04

SHA256
85b434be4782188e023e8d566d66965ace909a65e59cc7b9f3ba369341383c25

SHA512
806ca4d77dfb8ede375cac1e9b42e5641759ce79863fc321425776884730ed980c45a323dd4e4f2bd5afe10c814d68d4f1f6789b1109fda690dc6f6864d59d13

Download Submit
memory/2012-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2012-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-10-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-11-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-18-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-43-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-44-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-45-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-54-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-55-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-56-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-79-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-105-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-107-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-104-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-102-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2012-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2928-0-0x0000000002040000-0x00000000021F8000-memory.dmp

Filesize
1.7MB

Download
memory/2928-2-0x0000000002040000-0x00000000021F8000-memory.dmp

Filesize
1.7MB

Download
memory/2928-4-0x0000000002230000-0x00000000023E7000-memory.dmp

Filesize
1.7MB

Download